Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled…

CVE-2026-13474 is a missing-release-of-memory-after-effective-lifetime flaw (CWE-401) in NetScaler ADC and NetScaler Gateway. A remote unauthenticated attacker sends malformed HTTP/2 requests — stalled streams that never complete — and each request pins buffers that are never freed. Repeat that a few thousand times per second and the appliance exhausts memory, drops legitimate sessions, and eventually needs a reboot. It affects NetScaler ADC/Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18 (including FIPS and NDcPP variants), but *only* when HTTP/2 is enabled in the HTTP Profile bound to an LB, CS, VPN vserver, or service. 12.1 and 13.0 are EOL and receive no fix.

Citrix labeled it HIGH (7.5); VulDB and third-party trackers reassessed it to 8.7. Reality sits closer to Citrix's number — with a lean upward. It is *availability-only* (no confidentiality/integrity impact), so it is not another CitrixBleed. But the affected device *is* the perimeter: knocking out the ADC pair kills VPN, load-balanced apps, and Gateway-fronted VDI in one shot. For a box whose whole job is uptime, a pre-auth remote DoS is worse than the CVSS math implies.

Why this verdict

• Pre-auth, remote, network vector — no credentials, no user interaction, and NetScaler Gateway is by design exposed to the internet. Friction to reach step 1 is near-zero.
• Role multiplier: perimeter appliance. NetScaler ADC/Gateway IS the front door for VPN, VDI, and load-balanced apps. Chain outcome = enterprise-wide remote-access outage. This is a canonical high-value-role component (>10% of installs occupy the high-value edge role by definition) → verdict floor is HIGH.
• Role multiplier: internal ADCs. For east-west LB deployments not exposed externally, chain requires prior internal foothold and impact is limited to the balanced app tier — MEDIUM outcome, but does not lower the floor.
• Availability-only — no confidentiality/integrity impact caps this below CRITICAL. The 8.7 rescore from VulDB overweights environmental impact; we stay at 7.8.
• No KEV, no in-the-wild activity, EPSS 0.44% — pulls the score down inside the HIGH band but not out of it, because the adjacent HTTP/2 Rapid Reset/Bomb tooling makes weaponization cheap.
• Configuration-gated: vulnerability only fires when HTTP/2 is enabled in an HTTP Profile bound to a vserver. That is the default on modern 14.1 deployments, so it doesn't meaningfully narrow the population.

Why not higher?

CRITICAL requires code execution, data exfiltration, or full appliance takeover. This is memory leak → resource exhaustion → service unavailability. The sibling CVE-2026-8451 (CitrixBleed-3 memory overread) is the CRITICAL — 13474 rides in the same bulletin but doesn't have the same blast radius.

Why not lower?

A pure MEDIUM would ignore the deployment-role floor. Because NetScaler Gateway is the perimeter remote-access appliance, a pre-auth remote DoS is a business-continuity event during any coordinated intrusion — attackers routinely pair a Gateway DoS with a phishing wave to force MFA-bypass workflows. That floors this at HIGH.

1. Set Http2SmallWndTimeout to 30 seconds on every HTTP Profile bound to a vserver — Citrix explicitly calls this out as required in addition to patching, because the default value of 0 does not fully mitigate on non-strict profiles. Run set ns httpProfile <name> -http2SmallWndTimeout 30 for every profile. Deploy within the noisgate 30-day mitigation SLA for HIGH.
2. Disable HTTP/2 on HTTP Profiles that don't require it — set ns httpProfile <name> -http2 DISABLED. Legacy vservers fronting HTTP/1.1-only apps get no benefit from HTTP/2 and lose nothing by turning it off. Do this today on any profile you can, alongside the tuning above.
3. Rate-limit HTTP/2 SETTINGS/WINDOW_UPDATE floods at upstream WAF/CDN — Cloudflare, Akamai, Imperva, and AWS Shield already ship Rapid Reset / stalled-stream protections. If NetScaler sits behind them, enable those signatures and cap per-source stream creation rates within days.
4. Restrict Gateway management and low-value vservers to allow-listed source ranges — Anything that doesn't need public reachability shouldn't have it. Shrinks the reachable population dramatically. Bake into your edge firewall config within the same 30-day window.
5. Upgrade to 14.1-72.61 / 13.1-63.18 (or FIPS/NDcPP equivalents) — The vendor patch is the actual fix. Schedule the HA-pair rolling upgrade within the noisgate 180-day remediation SLA for HIGH, and aim to close within 60 days given the perimeter role.

Run this from an auditor workstation with SSH key access to the NetScaler NSIP. Invoke as ./check_cve_2026_13474.sh <nsip> (example: ./check_cve_2026_13474.sh 10.10.10.5). Requires an nsroot-equivalent read-only account to query build version and HTTP profile settings via SSH.

#!/usr/bin/env bash
# noisgate: CVE-2026-13474 NetScaler HTTP/2 memory-leak DoS check
# Usage: ./check_cve_2026_13474.sh <NSIP>
set -u
NSIP="${1:-}"
if [[ -z "$NSIP" ]]; then echo "Usage: $0 <NSIP>"; exit 2; fi

SSH_OPTS=(-o StrictHostKeyChecking=no -o ConnectTimeout=8 -o BatchMode=yes)

# 1. Grab firmware version
VER=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" 'show version' 2>/dev/null \
      | grep -oE 'NS[0-9]+\.[0-9]+: Build [0-9]+\.[0-9]+' \
      | head -1)
if [[ -z "$VER" ]]; then echo "UNKNOWN: cannot retrieve version from $NSIP"; exit 3; fi
echo "Detected: $VER"

# 2. Parse major.minor.build
MAJOR=$(echo "$VER" | grep -oE 'NS[0-9]+\.[0-9]+' | tr -d 'NS')
BUILD=$(echo "$VER" | grep -oE 'Build [0-9]+\.[0-9]+' | awk '{print $2}')

vuln=0
case "$MAJOR" in
  14.1)  awk "BEGIN{exit !($BUILD < 72.61)}" && vuln=1 ;;
  13.1)  awk "BEGIN{exit !($BUILD < 63.18)}" && vuln=1 ;;
  13.0|12.1) vuln=1 ;; # EOL, no fix
  *)     echo "UNKNOWN: unrecognized branch $MAJOR"; exit 3 ;;
esac

# 3. Check HTTP/2 enabled profiles bound to vservers
H2_PROFILES=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" \
  'show ns httpProfile' 2>/dev/null | awk '/Name:/{n=$2} /HTTP2:.*ENABLED/{print n}')

if [[ $vuln -eq 1 && -n "$H2_PROFILES" ]]; then
  echo "VULNERABLE: build $MAJOR-$BUILD < patched, HTTP/2 enabled on: $H2_PROFILES"
  exit 1
elif [[ $vuln -eq 1 ]]; then
  echo "VULNERABLE: build $MAJOR-$BUILD < patched (no HTTP/2 profiles seen; still upgrade)"
  exit 1
elif [[ -n "$H2_PROFILES" ]]; then
  # Patched build but verify Http2SmallWndTimeout mitigation
  BAD=$(ssh "${SSH_OPTS[@]}" nsroot@"$NSIP" 'show ns httpProfile' 2>/dev/null \
        | awk '/Name:/{n=$2} /Http2SmallWndTimeout:.*0 /{print n}')
  if [[ -n "$BAD" ]]; then
    echo "PATCHED but MISCONFIGURED: Http2SmallWndTimeout=0 on: $BAD"
    exit 1
  fi
  echo "PATCHED: build $MAJOR-$BUILD and Http2SmallWndTimeout set"
  exit 0
else
  echo "PATCHED: build $MAJOR-$BUILD (HTTP/2 not enabled)"
  exit 0
fi

Sources

1. Citrix Security Bulletin CTX696604
2. The Hacker News — Citrix Patches Six NetScaler Flaws
3. SecurityWeek — HTTP/2 Bomb Attack
4. VulDB CVE-2026-13474
5. runZero — Finding impacted NetScaler systems
6. GBHackers coverage
7. Kraft Kennedy bulletin summary
8. Feedly CVE-2026-13474